XSS Vulnerability fix in AppsController
[portal.git] / ecomp-portal-BE-os / src / test / java / org / onap / portalapp / portal / controller / AppsOSControllerTest.java
1 /*-
2  * ============LICENSE_START==========================================
3  * ONAP Portal
4  * ===================================================================
5  * Copyright (C) 2017 AT&T Intellectual Property. All rights reserved.
6  * ===================================================================
7  *
8  * Unless otherwise specified, all software contained herein is licensed
9  * under the Apache License, Version 2.0 (the "License");
10  * you may not use this software except in compliance with the License.
11  * You may obtain a copy of the License at
12  *
13  *             http://www.apache.org/licenses/LICENSE-2.0
14  *
15  * Unless required by applicable law or agreed to in writing, software
16  * distributed under the License is distributed on an "AS IS" BASIS,
17  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
18  * See the License for the specific language governing permissions and
19  * limitations under the License.
20  *
21  * Unless otherwise specified, all documentation contained herein is licensed
22  * under the Creative Commons License, Attribution 4.0 Intl. (the "License");
23  * you may not use this documentation except in compliance with the License.
24  * You may obtain a copy of the License at
25  *
26  *             https://creativecommons.org/licenses/by/4.0/
27  *
28  * Unless required by applicable law or agreed to in writing, documentation
29  * distributed under the License is distributed on an "AS IS" BASIS,
30  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
31  * See the License for the specific language governing permissions and
32  * limitations under the License.
33  *
34  * ============LICENSE_END============================================
35  *
36  * 
37  */
38 package org.onap.portalapp.portal.controller;
39
40 import static org.junit.Assert.assertEquals;
41
42 import java.util.ArrayList;
43 import java.util.List;
44 import javax.servlet.http.HttpServletRequest;
45 import javax.servlet.http.HttpServletResponse;
46 import org.junit.Before;
47 import org.junit.Ignore;
48 import org.junit.Test;
49 import org.mockito.InjectMocks;
50 import org.mockito.Mock;
51 import org.mockito.Mockito;
52 import org.mockito.MockitoAnnotations;
53 import org.onap.portalapp.portal.domain.EPUser;
54 import org.onap.portalapp.portal.ecomp.model.PortalRestResponse;
55 import org.onap.portalapp.portal.ecomp.model.PortalRestStatusEnum;
56 import org.onap.portalapp.portal.framework.MockEPUser;
57 import org.onap.portalapp.portal.framework.MockitoTestSuite;
58 import org.onap.portalapp.portal.service.AdminRolesService;
59 import org.onap.portalapp.portal.service.EPAppService;
60 import org.onap.portalapp.portal.service.PersUserAppService;
61 import org.onap.portalapp.portal.service.UserService;
62 import org.onap.portalapp.util.EPUserUtils;
63
64 public class AppsOSControllerTest {
65
66         @Mock
67         AdminRolesService adminRolesService;
68
69         @Mock
70         EPAppService appService;
71
72         @Mock
73         PersUserAppService persUserAppService;
74
75         @Mock
76         UserService userService;
77
78         @Mock
79         EPUserUtils ePUserUtils;
80
81         @Before
82         public void setup() {
83                 MockitoAnnotations.initMocks(this);
84         }
85
86         @InjectMocks
87         AppsOSController appsOSController;
88
89         MockitoTestSuite mockitoTestSuite = new MockitoTestSuite();
90
91         HttpServletRequest mockedRequest = mockitoTestSuite.getMockedRequest();
92         HttpServletResponse mockedResponse = mockitoTestSuite.getMockedResponse();
93         NullPointerException nullPointerException = new NullPointerException();
94         MockEPUser mockUser = new MockEPUser();
95
96         @Test
97         public void saveNewUserIfUserISNullTest() {
98                 PortalRestResponse<String> expectedportalRestResponse = new PortalRestResponse<String>();
99                 expectedportalRestResponse.setMessage("failure");
100                 expectedportalRestResponse.setResponse("New User cannot be null or empty");
101                 PortalRestStatusEnum portalRestStatusEnum = null;
102                 expectedportalRestResponse.setStatus(portalRestStatusEnum.ERROR);
103                 EPUser user = mockUser.mockEPUser();
104                 Mockito.when(EPUserUtils.getUserSession(mockedRequest)).thenReturn(user);
105                 PortalRestResponse<String> actualPortalRestResponse = appsOSController.saveNewUser(mockedRequest, null);
106                 assertEquals(expectedportalRestResponse, actualPortalRestResponse);
107         }
108
109         @Test
110         @Ignore
111         public void saveNewUserIfUserNOtNullTest() {
112                 PortalRestResponse<String> expectedportalRestResponse = new PortalRestResponse<String>();
113                 expectedportalRestResponse.setMessage("failure");
114                 expectedportalRestResponse.setResponse("UnAuthorized");
115                 PortalRestStatusEnum portalRestStatusEnum = null;
116                 expectedportalRestResponse.setStatus(portalRestStatusEnum.ERROR);
117                 EPUser user = mockUser.mockEPUser();
118                 EPUser user1 = mockUser.mockEPUser();
119                 user1.setLoginId("guest");
120                 user.setLoginId("guestT");
121                 Mockito.when(EPUserUtils.getUserSession(mockedRequest)).thenReturn(user1);
122                 Mockito.when(adminRolesService.isSuperAdmin(user)).thenReturn(false);
123                 Mockito.when(adminRolesService.isAccountAdmin(user)).thenReturn(false);
124                 PortalRestResponse<String> actualPortalRestResponse = appsOSController.saveNewUser(mockedRequest, user);
125                 assertEquals(expectedportalRestResponse, actualPortalRestResponse);
126         }
127
128         @Test
129         public void saveNewUserAndLoggedInUserIdSameTest() throws Exception {
130                 PortalRestResponse<String> expectedportalRestResponse = new PortalRestResponse<String>();
131                 expectedportalRestResponse.setMessage("Success");
132                 expectedportalRestResponse.setResponse("");
133                 PortalRestStatusEnum portalRestStatusEnum = null;
134                 expectedportalRestResponse.setStatus(portalRestStatusEnum.OK);
135                 EPUser user = mockUser.mockEPUser();
136                 user.setLoginId("guestT");
137                 Mockito.when(EPUserUtils.getUserSession(mockedRequest)).thenReturn(user);
138                 Mockito.when(adminRolesService.isSuperAdmin(user)).thenReturn(false);
139                 Mockito.when(adminRolesService.isAccountAdmin(user)).thenReturn(false);
140                 Mockito.when(mockedRequest.getParameter("isCheck")).thenReturn("test");
141                 Mockito.when(userService.saveNewUser(user, "test")).thenReturn("Success");
142                 PortalRestResponse<String> actualPortalRestResponse = appsOSController.saveNewUser(mockedRequest, user);
143                 assertEquals(expectedportalRestResponse, actualPortalRestResponse);
144         }
145
146         @Test
147         public void saveNewUserexceptionest() throws Exception {
148                 PortalRestResponse<String> expectedportalRestResponse = new PortalRestResponse<String>();
149                 expectedportalRestResponse.setMessage("failure");
150                 expectedportalRestResponse.setResponse(null);
151                 PortalRestStatusEnum portalRestStatusEnum = null;
152                 expectedportalRestResponse.setStatus(portalRestStatusEnum.ERROR);
153                 EPUser user = mockUser.mockEPUser();
154                 user.setLoginId("guestT");
155                 Mockito.when(EPUserUtils.getUserSession(mockedRequest)).thenReturn(user);
156                 Mockito.when(adminRolesService.isSuperAdmin(user)).thenReturn(false);
157                 Mockito.when(adminRolesService.isAccountAdmin(user)).thenReturn(false);
158                 Mockito.when(mockedRequest.getParameter("isCheck")).thenReturn("test");
159                 Mockito.when(userService.saveNewUser(user, "test")).thenThrow(nullPointerException);
160                 PortalRestResponse<String> actualPortalRestResponse = appsOSController.saveNewUser(mockedRequest, user);
161                 assertEquals(expectedportalRestResponse, actualPortalRestResponse);
162         }
163
164         @Test
165         public void getCurrentUserProfileTest() {
166                 String loginId = "guestT";
167                 EPUser user = mockUser.mockEPUser();
168                 List<EPUser> expectedList = new ArrayList<EPUser>();
169                 expectedList.add(user);
170                 Mockito.when(userService.getUserByUserId(loginId)).thenReturn(expectedList);
171                 String expectedString = appsOSController.getCurrentUserProfile(mockedRequest, loginId);
172                 assertEquals("{\"firstName\":\"test\",\"lastName\":\"test\"}", expectedString);
173         }
174
175         @Test
176         public void getCurrentUserProfileXSSTest() {
177                 String loginId = "<iframe/src=\"data:text/html,<svg &#111;&#110;load=alert(1)>\">";
178                 EPUser user = mockUser.mockEPUser();
179                 List<EPUser> expectedList = new ArrayList<>();
180                 expectedList.add(user);
181                 Mockito.when(userService.getUserByUserId(loginId)).thenReturn(expectedList);
182                 String expectedString = appsOSController.getCurrentUserProfile(mockedRequest, loginId);
183                 assertEquals("loginId is not valid", expectedString);
184         }
185
186         @Test
187         public void getCurrentUserProfileExceptionTest() {
188                 String loginId = "guestT";
189                 EPUser user = mockUser.mockEPUser();
190                 List<EPUser> expectedList = new ArrayList<EPUser>();
191                 expectedList.add(user);
192                 Mockito.when(userService.getUserByUserId(loginId)).thenThrow(nullPointerException);
193                 String expectedString = appsOSController.getCurrentUserProfile(mockedRequest, loginId);
194                 assertEquals("{}", expectedString);
195         }
196
197 }